diff --git a/.changeset/lazy-rockets-dress.md b/.changeset/lazy-rockets-dress.md
new file mode 100644
index 0000000000..b11857af04
--- /dev/null
+++ b/.changeset/lazy-rockets-dress.md
@@ -0,0 +1,5 @@
+---
+'@backstage/plugin-scaffolder-backend': patch
+---
+
+Fix token pass-through for software templates using beta 3 version
diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts
index b933990953..aace2cb437 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.test.ts
@@ -22,7 +22,7 @@ import { NunjucksWorkflowRunner } from './NunjucksWorkflowRunner';
 import { TemplateActionRegistry } from '../actions';
 import { ScmIntegrations } from '@backstage/integration';
 import { ConfigReader } from '@backstage/config';
-import { TaskContext, TaskSpec } from './types';
+import { TaskContext, TaskSpec, TaskSecrets } from './types';
 
 const realFiles = Object.fromEntries(
   [
@@ -49,8 +49,12 @@ describe('DefaultWorkflowRunner', () => {
     }),
   );
 
-  const createMockTaskWithSpec = (spec: TaskSpec): TaskContext => ({
+  const createMockTaskWithSpec = (
+    spec: TaskSpec,
+    secrets?: TaskSecrets,
+  ): TaskContext => ({
     spec,
+    secrets,
     complete: async () => {},
     done: false,
     emitLog: async () => {},
@@ -182,6 +186,32 @@ describe('DefaultWorkflowRunner', () => {
         name: templateName,
       });
     });
+
+    it('should pass token through', async () => {
+      const fakeToken = 'secret';
+      const task = createMockTaskWithSpec(
+        {
+          apiVersion: 'scaffolder.backstage.io/v1beta3',
+          parameters: {},
+          output: {},
+          steps: [
+            {
+              id: 'test',
+              name: 'name',
+              action: 'jest-validated-action',
+              input: { foo: 1 },
+            },
+          ],
+        },
+        {
+          token: fakeToken,
+        },
+      );
+
+      await runner.execute(task);
+
+      expect(fakeActionHandler.mock.calls[0][0].token).toEqual(fakeToken);
+    });
   });
 
   describe('conditionals', () => {
diff --git a/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts b/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts
index a3e30c65fe..71d53cc7ec 100644
--- a/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts
+++ b/plugins/scaffolder-backend/src/scaffolder/tasks/NunjucksWorkflowRunner.ts
@@ -257,6 +257,7 @@ export class NunjucksWorkflowRunner implements WorkflowRunner {
           await action.handler({
             baseUrl: task.spec.baseUrl,
             input,
+            token: task.secrets?.token,
             logger: taskLogger,
             logStream: streamLogger,
             workspacePath,